The full anatomy of a phishing site,
one URL at a time.
ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.
Phishing detected
| URL | hxxps://societegenerale-monespace[.]bolt[.]host/ | |
| Host | societegenerale-monespace[.]bolt[.]host | |
| Registered domain | bolt[.]host | |
| Brand | Societe Generale / Mon espace | |
| Screenshot | https://cdn.zerophish.ai/a289f657-544f-4288-bc7e-6317e4f06fe4.jpg | |
| Scan ID | 3681a67a-e7db-4c92-9aa4-b5761d8935e2 |
| Host | societegenerale-monespace.bolt.host |
| Registered domain | bolt.host |
| Scheme | https |
| Content length | 41518 B |
| HTTP | 200 · text/html |
| JARM | 0d39b39b30d30d37d20320327d20122de7c02fe862e334985aa656e5df0651 |
| Redirect hops | 1 |
The page presents almost no content beyond a loading screen: the HTML shows only a basic “Chargement…” (loading) message and no visible login, form fields, or account prompts.
While the URL path contains “societegenerale-monespace”, which resembles a Societe Generale “Mon espace” portal, the provided HTML/OCR lacks any brand UI, security warnings, or credential-collection elements to confirm an impersonation attempt. Because there is insufficient rendered content to verify a credential form or a mismatch between brand and origin, the evidence is inconclusive.
Overall, I lean conservative: treat this as likely benign for now, but monitor for real content when the page finishes loading (e.g., a login form on a non–Societe Generale domain).
The page at societegenerale-monespace.bolt.host impersonates Société Générale, a major French bank — “Mon Espace” is their customer portal branding. The page loads disable-devtool, an anti-analysis library that prevents opening browser developer tools, a technique strongly associated with phishing kits. It is hosted on bolt.host (linked to bolt.new, a web-app builder), not on any legitimate Société Générale domain. The page was stuck in a redirect loop at /ntmfdp and never rendered a form, but the domain structure, brand impersonation, anti-debugging measures, and free-tier hosting together confirm this is a phishing infrastructure setup.